[yehosef]

Nowadays using something like elasticsearch is common for this and then you don't have to reparse it. It's already indexed and you can search for what you want.

If you're going back to the raw text files, then you're right. But I'm not sure why anyone would do that these days.

[haddr]

but then it might be expensive to encode every possible dimension in the log stream